well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.
Nope. First of all, the FO was the “pilot flying” and thusly controls the throttle. The fuel shutoffs are on the left side, well clear of the range of motion throttle operation for the right seat.
If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.
Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.
Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.
And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)
The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.
You are wrong. The fuel shutoff switches are directly beneath the throttle levers, and they move down to cutoff, which is exactly the direction a hand beneath the throttle would move to accidentally switch them to cutoff.
Secondly, while the FO was flying the airplane and thus would have control of the throttles during rollout, the captain would certainly have his hand beneath the throttles in an observer position during at least part of the takeoff. And during takeoff, procedure would have the captain take over control of the throttle levers until rotation while the FO handled the yoke with both hands.
blancolirio[0] has two excellent video examples of 787 takeoffs within the cockpit showing FO-pilot takeoffs and both officers' actions during takeoff.
Page 10 of the Air India preliminary report[1] shows a picture of the fuel cutoff switches -- clearly labeled "FUEL CONTROL" with "RUN" in the up position and "CUTOFF" in the down position -- directly beneath the throttle levers.
This. There are no flip-covers on the switches in any of the photos I've seen. Additionally, it looks like the side guards are only on the left and right sides of the pair of cutoff switches, not in-between the two switches. So if one bumped one switch, seems like it would be very easy to bump them both.
There's a metal nib on the switch and switch housing preventing it from being bumped. There's also a spring holding it down so it can't bounce up. The distance and required force makes switching them at the same time impossible, thus the 1 second difference. This was absolutely an intentional act.
One can easily switch them with two fingers at the same time.
I tried (with similar switches.): Works. If the locking mechanism fails, even unintentionally.
Getting loose, wristworn jewlery snatched and then pull: Works.
My question to Boeing is:
Why did you cover the neighbouring (stabilizer cut-off, IIRC) switches with red springloaded flip-covers, but not the fuel cut-off switches?
please. pilot puts everyone to sleep but himself, turns everything off, then does a flyby of his hometown and then puts himself to sleep? the only one more obvious is the german one.
It feels quite uncomfortable to me. I remember using this exact example of why the changes after the German wings crash wouldn't prevent a murder suicide in the future.
The issue with the 737 MAX became evident within months of the plane's launch. By contrast, the Dreamliner has accumulated over a decade of flying history across over 1000 aircraft with precisely zero fatal accidents.
The fact that the pilots denied that they had shut the switch (one asking the other why they had done so and the other denying it), and that they restarted the engines should be taken into account. Ok, murder suicide is definitely on the table but I would want to see some other reasons for believing that this is so.
Sorry to nitpick, but for a good Bayesian, absence if evidence is evidence of absence. If you want the aphorism to be technically correct, you should say "absence of proof is not proof of absence".
A note on the terminology: "evidence" is a piece of data that suggests a conclusion, while not being conclusive by itself. Whereas "proof" is a piece of data that is conclusive by itself.
For a long time my wife refused to accept that Tree Kangaroos existed and insisted that I'd made them up. When the internet came along she looked them up and treated me strangely for a while.
What things that you have never seen do you not believe in?
(not the OP) Giant isopods. They're not real. I know there are pictures of what are supposed to be giant isopods but they are not real animals, instead they're clearly fake models of made-up animals.
A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.
The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.
He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.
Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.
My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.
I'm not disagreeing with you I think this was manually done
But here's the thing a "near zero chance" when we are talking about an actual event changes the math
Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident
Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure
So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded
We could also suggest that aliens in the cockpit did it — about the same probability. Two switches, on independent circuits, both failing within one second of each other in the exact same way?
Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
What is "01 second" as quoted above? If it's 1 second, you could possibly conclude that it was intentional. If it's 0.1 second you might think it was an accident and the lock was disengaged.
There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.
Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.
You don’t inadvertently turn off both switches. The linked SAIB was in 2018 and addresses faulty installations, not a failure after use. And preflight over thousands of flights would have detected if the switches had a failed locking mechanism. And for both to fail at once? Practically impossible. Also the recommended inspection — that was almost 7 years ago. If a major airline didn’t comply with the SAIB, that’s on them, not Boeing. There hasn’t been a single reported instance of fuel switches being accidentally switched off on any Boeing airliner — in 320 million flight hours over the past 10 years.
The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.
They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
More like 30 seconds. Just throttling an already running engine up from idle (which is quite a bit above zero throttle in most respects) takes seconds.
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
Here is the full SAIB on the Boeing fuel control switches. This report lists the part 4TL837-3D as the switch used on 787s, and is the part mentioned in the preliminary report on the accident.
The SAIB does single out the part 766AT613-3D, but that's for suggesting a replacement for it as 766AT614-3D.
Per the Honeywell catalog for 4TL837-3D, if is a Snap Action toggle switch. The base model doesn't have a locking mechanism, which is available as an option
still, it at least shows that there's been issues with the locking mechanism in the past. inadvertently bumping something that was assumed to be locked is a simpler theory; i find it hard to believe that a murder suicider would take this route, when the china nosedive option is easier, faster, and has a higher chance of success.
The preliminary report says the switches were triggered a second apart, so it would have to have been faulty switches and two inadvertent bumps. That seems unlikely to me.
Within a second apart. If I read the report right. The time resolution of the recorder?
And yes, it does sound like it was probably intentional. I would still like to see an engineering review of the switch system. Are they normally open or normally closed, In the end the switch instructs the FADEC to cut the fuel, but where does the wiring go in the meantime? what software is in the path? would the repair done before the flight be in that area?(pilot defect report for message STABS POS XCDR), and perhaps compromised the wires?
It's interesting to try to imagine a device that would prevent that, without causing more issues.
My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?
It’s a pointless exercise though - if one of the pilots wants to crash the plane, there’s almost nothing that can possibly be done. Only if someone can physically restrain them and remove them from the controls.
There’s always going to be many ways they could crash the plane, such a feature wouldn’t help. The pilots are the only people you can’t avoid fully trusting on the plane.
It's only pointless if we assume crashing was the intended result of the pilot. If the switches failed, or the pilot activated the switches by mistake, it's worth considering options for handling the inputs.
There's a balance of accidents to be found, I think. There are likely cases where fuel does need to be cut off to both engines, and preventing that would lead to accidents that might have been recoverable. This case shows that cutting off fuel to both engines during takeoff is likely unrecoverable. There have been cases where fuel is cutoff to the wrong engine, leading to accidents. Status quo might be the right answer, too.
So basically we need software that can 100% autonomously fly a plane. Software that is extremely reliable and trustworthy, basically. Software with multiple fallback options. Multiple AI agents verifying every action this software takes. Plus, ground-based teams monitoring the agents and the autonomous flight software.
> Again, it’s probably pointless but it’s an interesting thought exercise.
Coming up with ad-hoc solutions is easy, especially the less you know about a complex system and its constraints. I'd say it's not an interesting exercise unless you consider why a solution might not exist already, and what its trade-offs and failure modes are. Otherwise, all you're doing is throwing pudding against a wall, which can of course be fun.
That’s the whole fun part - come up with an “obvious” solution and the try to figure out the problems or risks it would cause.
For example, an obvious solution is that the switch can't be changed from "RUN" to "CUTOFF" when the throttle isn't at idle - this could be done with a mechanical detent because they're right next to each other. Simple!
But now you've introduced additional failure modes - throttle sticks wide open and the engine is vibrating and needs to be shut down - so maybe you make it that the shutdown switch can work for ONE engine at any throttle position, but if TWO get turned off, both throttles have to be off, but that introduces ...
Or you simply interlock the engine cutoff with the thrust lever position, any position other than idle prevents shutdown. This all goes through the flight computers already.
If there’s a fire or similar problem the fire handles will cut off fuel without the normal shutdown procedure, but the normal switches only need to be used at idle thrust.
I wonder if Airbus has this logic, since their philosophy is to override the pilot commands if they’d endanger the aircraft (which has its own issues of course) where’s Boeing will alert the pilots and still perform the action. I don’t have access to that information.
According to AI, Airbus places these switches on the overhead panel, so that alone would make it harder to inadvertently move them. Apparently, Airbus "protections do not extend to mechanical or FADEC‑controlled systems like the engine‑fuel shutoff valves. If you deliberately pull and flip the ENG MASTER lever to OFF, the FADEC will immediately close the LP and HP fuel valves and the engine will flame out. If you then return the lever to RUN (and you meet relight conditions), it will automatically relight."
As another commenter said the Airbus engine start/stop controls are located behind the thrust levers, and according to the A350 operations manual which I got my hands on there are two conditions required for the FADEC to command engine shut down: Run switch to off, thrust lever to idle.
So if that's correct on an Airbus aircraft you can't just switch off the engines when they're commanded to produce thrust. This also seems to be backed up by the difference in the guards for those controls in the Airbus cockpits.
The wings hosts the engine and a good portion of the fuel is quite a bit back from the nose in a big plane like 787. The engines lost power and hit just 180 knots just 4 seconds after the plan lifted off. The plane could have just easily broken up differently where the nose crashed in a different spot than where the fire would likely start.
At such a slow speed and altitude they could even have well crashed inside the airport perimeter and got a quicker/ better emergency response from the fire units at the airport.
Attempting this during takeoff or landing when the pilot monitoring is fully engaged and closely observing would be most difficult to execute .
Yes, the S.A.I.B. was about the switch, which is used in many airplanes,
and _should_ be checked and replaced. But they didn't. Because it wasn't mandatory. So my guess is those 50-70€ per switch were too expensive for the airline?
They reported that they replaced the whole middle console twice, so I cannot accept the 'it's pricey' or 'it's non-mandantory' as an excuse.
Hackers gona hack, so I'd like to get my hands on those switches, or better the whole fuel control panel. The pictures don't let me see or feel if a loose front panel could lift those shiny glowy locking knobs up by, say, 2.3mm and therefore unlock those switches, for example.
Only picture I could find online about this malfunctioning switch:
which looks like a really nasty 'mechanical inadequacy': half of the locking mechanism is the shiny glowy knobs. And they could _turn_. WTHolyF!? What where they smoking when designing or reviewing this?
In this fine post here, if you can read chinese or click the translation button on your browser:
(CAVE: I'm not inside boeing's tech support system so I cannot verify this from the original maintainance manual, since they seem to be practically guarded as trade secrets...)
I tried to order some of those switches (766AT613-3D and 766AT614-3D) and hope they get delivered ... this year. Anyone here got their hands on those switches to test their feel when handling or their resiliency?
(My hypothesis is:
Hand on throttle, Hand pushes throttle full forward to start, Hand rests on throttle while accellerating, then pilot does the routine rotate and plane takes of and all is fine and Hand lets go of throttle, Hand falls on both switches directy behind the throttle: Click-click-WTF?-BOOM.)
Of Course almost anyone involved in the airplane industry would prefer this to be a clear-cut case of 'pilot error' or 'Terrorism/Insanity' - but that doesn't exnorate the manufacturer or owner of building and flying an airplane where the engines can be shut off while taking off, IMHO.
As an aside, I especially like the disclaimers on the last page of Honeywells catalogue (this one: https://www.farnell.com/datasheets/2604543.pdf)
- don't use it for anything safety-of-live related.
- if it breaks because we delivered junk, we'll replace the switch - nothing else.
(I'm paraphrasing. Some laywers migth find a way to get out of this. I hope Boeing doesn't.).
Correction, I quoted the wrong price:
Honeywell's 4TL837-3D, which is the switch in the 787s according to the SAIB "EASA_SIB_NM-18-33_1-1.pdf", costs about 1300€. MIL-spec &c. certifications are costly.
Still cheap enough to not risk killing hundreds of people with the flick of a wrist.
Sorry about that.
And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:
"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on
December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking
feature. This SAIB was issued based on reports from operators of Model 737 airplanes that
the fuel control switches were installed with the locking feature disengaged. The airworthiness
concern was not considered an unsafe condition that would warrant airworthiness directive
(AD) by the FAA. The fuel control switch design , including the locking feature, is similar on
various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8
aircraft VT-ANB. As per the information from Air India, the suggested inspections were not
carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records
revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023.
However, the reason for the replacement was not linked to the fuel control switch. There has
been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."
So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.
There Is a connection: The same type and make of switches, which already where officially found to be prone to subtle malfunction and ought to be checked and replaced. Read the SAIB.
Look at the switches. https://www.xuefeiji.org/public/uploads/weixin_mpimgs/e3/e36...
Your argument of being "totally different" flight decks or fordy ignition switches aside (ignoring that one is allowed to to drive both mentioned cars using the same license, but not two different generations of airplanes, ignoring that the biological concept of generation implies kinship), this affair reminds me of https://en.m.wikipedia.org/wiki/General_Motors_ignition_swit...
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown